v16.0 Known CVE checks

Bastion 16.0 (current zip includes the QoL, performance, and encryption patch). Known CVE checks on main menu C and Recovery hub 7. CVE undo items, DNS snapshots, and RDP host prior are DPAPI-wrapped. Bastion-owned data folders get a SYSTEM + Administrators ACL. Always start with Bastion-Hardening.bat. Bastion cannot patch Microsoft kernel CVEs; those rows start Windows Update.